feat: add role preview to permission calculation

[GalaxyAkiii]

Adds role preview capabilities to stoat.js, allowing client applications to calculate permissions, channel visibility, and mention counts from the perspective of specific server roles without altering actual authenticated session state.

Changes

• Client:
  • Adds viewAs signal and setViewAs(server?: string, roles?: string[]) to set or clear the active preview.
  • Adds an HTTP API request interceptor (#guardAPI) that blocks non-GET mutation requests targeted at the previewed server (including /servers/, /channels/, /custom/emoji/, /webhooks/, and DELETE /invites/), rejecting with { type: "ViewingAsRole" }. Requests whose server cannot be resolved (such as invite deletions, or uncached emojis/webhooks) are also blocked while previewing. Read receipts (/ack) and /search remain permitted. The guard is re-applied in #updateHeaders() to persist across session updates.
• Server:
  • Adds previewRoles getter returning the active preview roles in priority order.
  • defaultChannel, unread, and mentions filter out channels that the previewed roles cannot view. defaultChannel flattens ordered categories to check preview visibility, preserving existing behaviour when not previewing.
• ServerMember:
  • Exposes realRanking (original hierarchy ranking).
  • ranking returns the previewed role rank for the authenticated member during an active preview.
• calculatePermission:
  • When previewing and no explicit member is provided, permissions are calculated using a stand-in member with the previewed roles. Because the stand-in has no user ID, the owner bypass does not apply.

How was this PR tested?

• Verified HTTP API mutation guard blocks writes with { type: "ViewingAsRole" }, permits acks, and allows normal writes again once the preview is stopped (setViewAs()).
• Unit tests covering permission calculation, hierarchy ranking, channel filtering, and write-blocking are included in the companion for-web PR (src/interface/navigation/channels/viewAs.test.ts).
• Typecheck (tsc --noEmit) passes cleanly.

Checklist:

• I have carefully read the contributing guidelines
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if applicable
• I have no unrelated changes in the PR
• I have confirmed that any new dependencies are strictly necessary
• I have written tests for new code (if applicable)
• I have followed naming conventions/patterns in the surrounding code

Please declare, if any, LLM usage involved in creating this PR

None